PT-2013-1885 · Openssl+2 · Openssl+2

Jan Lieskovsky

·

Published

2013-02-24

·

Updated

2023-02-13

·

CVE-2012-6093

CVSS v2.0

4.3

Medium

VectorAV:N/AC:M/Au:N/C:P/I:N/A:N
Name of the Vulnerable Software and Affected Versions Qt versions prior to 4.6.5 Qt versions 4.7.x prior to 4.7.6 Qt versions 4.8.x prior to 4.8.5
Description The issue arises from the QSslSocket::sslErrors function, which, when used with certain versions of openSSL, may read memory from an incorrect location due to an incompatible structure layout. This can lead to Qt reporting an incorrect error when certificate validation fails, potentially causing users to make unsafe security decisions and accept an invalid certificate.
Recommendations For Qt versions prior to 4.6.5, update to version 4.6.5 or later. For Qt versions 4.7.x prior to 4.7.6, update to version 4.7.6 or later. For Qt versions 4.8.x prior to 4.8.5, update to version 4.8.5 or later.

Fix

Weakness Enumeration

CWE-310

Related Identifiers

CVE-2012-6093

Affected Products

Qt
Suse
Openssl